def testGenerateEndpointHash(self):
etm, state, callbacks = self._cetm()
mockRequestInfo = GenericMock()
mockRequestInfo.method = "GET"
mockRequestInfo.url = URL("http://www.example.org/users")
mockRequestInfo.status = "200"
hash, _, _ = etm.generateEndpointHash(mockRequestInfo)
self.assertEquals(hash, "GET|http://www.example.org/users")
def testIssueCheckerOldReportedIssues(self):
state = GenericMock()
callbacks = GenericMock()
issue = GenericMock()
issue.url = URL("http://www.example.org/users")
issue.issueName = "SQL Injection"
callbacks.getScanIssues.return_value = [issue]
ic = IssueChecker(state, callbacks)
self.assertTrue(
ic.reportedIssues['SQL Injection|http://www.example.org/users'])
def testGenerateEndpointHash64ByteHexadecimal(self):
etm, state, callbacks = self._cetm()
mockRequestInfo = GenericMock()
mockRequestInfo.method = "GET"
mockRequestInfo.url = URL(
"http://www.example.org/users/748bbea58bb5db34e95d02edb2935c0f25cb1593e5ab837767e260a349c02ca7"
)
mockRequestInfo.status = "200"
hash, _, _ = etm.generateEndpointHash(mockRequestInfo)
self.assertEquals(hash, "GET|http://www.example.org/users/{ID}")
def testIssueCheckerTwice(self):
ic, state, callbacks = self._ic()
state.scope_urls = ["http://example.org/"]
ic.reportIssue = GenericMock()
issue = GenericMock()
issue.url = URL("http://www.example.org/users")
issue.issueName = "SQL Injection"
secondIssue = GenericMock()
secondIssue.url = URL("http://www.example.org/users")
secondIssue.issueName = "Remote Code Execution"
callbacks.getScanIssues.return_value = [issue]
ic.run()
self.assertEquals(ic.reportIssue.call_count, 1)
callbacks.getScanIssues.return_value = [issue, secondIssue]
ic.run()
self.assertEquals(ic.reportIssue.call_count, 2)
def testIssueCheckerOnlyOnce(self):
ic, state, callbacks = self._ic()
state.scope_urls = ["http://example.org/"]
ic.reportIssue = GenericMock()
issue = GenericMock()
issue.url = URL("http://www.example.org/users")
issue.issueName = "SQL Injection"
callbacks.getScanIssues.return_value = [issue]
ic.run()
self.assertEquals(ic.reportIssue.call_count, 1)
ic.run()
self.assertEquals(
ic.reportIssue.call_count, 1,
"Should still be one because it's the same issue and it has already been reported."
)
